Falhas do tipo CWE-404

624 resultados

Liberação inadequada de recursos

Ocorre quando o software não libera corretamente recursos como conexões de banco de dados, arquivos abertos, memória ou sockets de rede. Isso leva a esgotamento de recursos (resource leak), causando travamentos, negação de serviço ou comportamento imprevisível da aplicação ao longo do tempo.

Exemplo

Um servidor web que abre uma conexão com banco de dados para cada requisição, mas não a fecha adequadamente em caso de erro — após milhares de requisições, todas as conexões disponíveis se esgotam e novas requisições falham ou travam.

Como mitigar

Use padrões como try-finally ou try-with-resources (em Java) para garantir que recursos sejam liberados mesmo em exceções. Implemente timeouts e monitoramento de recursos abertos; realize testes de carga para detectar leaks antes da produção.

CVE-2022-44267MEDIUMImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waEPSS 76.6%CVE-2018-8120HIGHAn elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k EPSS 73.7%KEVCVE-2018-8639HIGHAn elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k EPSS 22.3%KEVCVE-2023-3206MEDIUMChengdu VEC40G denial of serviceEPSS 18.7%CVE-2025-1103HIGHD-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereferenceEPSS 13.0%CVE-2024-12342HIGHTP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of serviceEPSS 8.9%CVE-2022-25762—Response mix-up with WebSocket concurrent send and closeEPSS 8.4%CVE-2022-2591HIGHTEM FLEX-1085 reboot denial of serviceEPSS 8.2%CVE-2025-8761HIGHINSTAR 2K+/4K Backend IPC Server denial of serviceEPSS 6.9%CVE-2024-0546MEDIUMEasyFTP LIST Command denial of serviceEPSS 6.8%CVE-2018-19591HIGHIn the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation oEPSS 5.5%CVE-2018-8611HIGHAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaEPSS 4.2%KEVCVE-2024-0737MEDIUMXlightftpd Xlight FTP Server Login denial of serviceEPSS 4.2%CVE-2025-15229MEDIUMTenda CH22 DhcpListClient fromDhcpListClient denial of serviceEPSS 4.0%CVE-2024-0725MEDIUMProSSHD denial of serviceEPSS 3.6%CVE-2024-0723MEDIUMfreeSSHd denial of serviceEPSS 3.6%CVE-2018-8836—Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 waEPSS 3.6%CVE-2025-48989HIGHApache Tomcat: h2 DoS - Made You ResetEPSS 3.5%CVE-2025-8671HIGHCVE-2025-8671EPSS 3.5%CVE-2018-8405HIGHAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "EPSS 3.4%KEV